android-security-13.0.0_r1 to android-security-13.0.0_r2 AOSP changelog

1d8a0257e4 : Fix use-after-free issue for dexfile

c4792470c7 : Version bump to TSV1.220628.024 [core/build_id.mk]
95c102c944 : Version bump to TSV1.220628.023 [core/build_id.mk]
54facb11c1 : Version bump to TSV1.220628.022 [core/build_id.mk]
b830b7294b : Version bump to TSV1.220628.021 [core/build_id.mk]
b5805deac2 : Version bump to TSV1.220628.020 [core/build_id.mk]
17c2df17f5 : Version bump to TSV1.220628.019 [core/build_id.mk]
1bb84a2f87 : Version bump to TSV1.220628.018 [core/build_id.mk]
09a155fe07 : Version bump to TSV1.220628.017 [core/build_id.mk]
e0f2bbf396 : Support chained init_boot partition signing
4b031b9e7e : Version bump to TSV1.220628.015 [core/build_id.mk]
bc57ba1302 : Version bump to TSV1.220628.014 [core/build_id.mk]
e91bc0e99d : Version bump to TSV1.220628.013 [core/build_id.mk]
a8d8f9e37d : Version bump to TSV1.220628.012 [core/build_id.mk]
f8da244218 : Version bump to TSV1.220628.011 [core/build_id.mk]
f868c2b54b : Version bump to TSV1.220628.010 [core/build_id.mk]
704bf9e9ee : Version bump to TSV1.220628.009 [core/build_id.mk]
61a0712dc2 : Version bump to TSV1.220628.008 [core/build_id.mk]
1a32de5783 : Version bump to TSV1.220628.007 [core/build_id.mk]
1e8c661f89 : Version bump to TSV1.220628.006 [core/build_id.mk]
04f9e31c48 : Version bump to TSV1.220628.005 [core/build_id.mk]
17c17f4838 : Version bump to TSV1.220628.004 [core/build_id.mk]
17d732e55f : Version bump to TSV1.220628.003 [core/build_id.mk]
912fc0827b : Version bump to TSV1.220628.002 [core/build_id.mk]

a1aa34909 : ANDROID: Verify virtio queue address ranges are valid

3c8bd4a : [automerge] libfdt: fdt_path_offset_namelen: Reject empty paths 2p: a6ac6d916d 2p: c69e9730e6
d24b7ee : Fix integer wrap sanitisation.
e189587 : [automerge] FROMGIT: libfdt: fdt_offset_ptr(): Fix comparison warnings 2p: 6f0fef2b2a 2p: 736c673f28

8b19476e : [CVE-2022-43680] Fix overeager DTD destruction (fixes #649)

4881da8bf9 : RESTRICT AUTOMERGE Use static token for myAttributionSource in ServiceUtilities
1e2ff894d4 : move MediaCodec metrics processing to looper thread
b072419650 : audio policy: fix sensor privacy listener
1bdedbb25e : Fix Out of Bounds Read in AAVCAssembler
bae3b00a58 : audio: fix missing package name in attribution source
653fa60872 : libstagefright: fix heap use after free issue
68aa4c1f5e : [Fix vulnerability] setSecurityLevel in clearkey
8cb854cf41 : Add missing bounds checks
d3070a5126 : Cache MMAP client silenced state.

5e457e2a2bb1 : Disallow clicks on privacy chip before provisioned
8f55482f3f7e : RESTRICT AUTOMERGE Use chain start token in performOpTransaction
4ade97466b74 : Use rule package name in addAutomaticZenRule; specify "android" for all system apps
5b8c79ce706c : Convert argument to intent in ChooseTypeAndAccountActivity
e94e04eba84b : [RESTRICT AUTOMERGE] Correct the behavior of ACTION_PACKAGE_DATA_CLEARED
cc59bd0aa23b : [DO NOT MERGE] Revert "Check rule package name in ZenModeHelper.addAutomaticRule"
de6824bb7efe : [DO NOT MERGE] Revert "Fix system zen rules by using owner package name if caller is system"
4113e0acf4b9 : Fix system zen rules by using owner package name if caller is system
490fc265d3bc : Check rule package name in ZenModeHelper.addAutomaticRule
16c604aa7c25 : Ensure that only SysUI can override pending intent launch flags
bb1009673650 : Fix sharing to another profile where an app has multiple targets
7eff067c1cb8 : Add protections against queueing a UsbRequest when the underlying UsbDeviceConnection is closed.
90b4be4c13ed : [SettingsProvider] workaround for DevicePolicyResourcesManager
9ad3d25b4e9b : RESTRICT AUTOMERGE Revoke SYSTEM_ALERT_WINDOW on upgrade past api 23
640e625c8567 : Trim the activity info of another uid if no privilege
6295d7a6daf2 : [RESTRICT AUTOMERGE][SettingsProvider] key size limit for mutating settings
6f8dc4d6ce3a : RESTRICT AUTOMERGE Validate permission tree size on permission update
480a28fc3dae : [RESTRICT AUTOMERGE] [SettingsProvider] mem limit should be checked before settings are updated
6422cba34482 : Disable all A11yServices from an uninstalled package.
889229eedf17 : Limit lengths of fields in Condition to a max length.
0407c04aae5e : Limit length and number of MIME types you can set
7a6528992608 : [DO NOT MERGE] Revert "Check rule package name in ZenModeHelper.addAutomaticRule"
73b491fc0e41 : [DO NOT MERGE] Revert "Fix system zen rules by using owner package name if caller is system"
a7de66d92b79 : Update Parcel readLazyValue to ignore negative object lengths
cff7c94903b7 : Add safety checks on KEY_INTENT mismatch.
447333ab45b5 : Lower per-app notificationchannel limit
56dd904b0723 : Ignore malformed shortcuts
6c61ae102870 : Allow activity to be reparent while allowTaskReparenting is applied
37129473a829 : Fix a security issue in app widget service.
6d0daf93fd65 : Fix NPE
132aaeb8d525 : New Pipeline: hide VISIBILITY_SECRET notifications on lock screen
423bbdef31ec : [pm] forbid deletion of protected packages
77a54107231f : Include all enabled services when FEEDBACK_ALL_MASK.
47af07fbf1fc : Prevent exfiltration of system files via avatar picker.
323a44aadb13 : TEST ONLY, please ignore this cherrypick (https://b.corp.google.com/issues/244482743#comment3). GitWatcher: ignore ------------------------------
85ca64e2bcfc : Validate package name passed to setApplicationRestrictions. (Reland)
33d74fb91631 : Prevent non-admin users from deleting system apps.
8e4a6ecb0e03 : Limit the size of NotificationChannel and NotificationChannelGroup
86dbbfea063a : Revert "Prevent non-admin users from deleting system apps."
aeaab77cf79c : Do not dismiss keyguard after SIM PUK unlock
cbfc52dabdc6 : Fix system zen rules by using owner package name if caller is system
90857cd54f63 : Remove legacy WRITE_EXTERNAL_STORAGE permission check for Installers
754760b17f6c : Trim any long string inputs that come in to AutomaticZenRule
3394dbd19f29 : Fix auto-grant of AR runtime permission if device is upgrading from pre-Q
7a6833cec280 : Check rule package name in ZenModeHelper.addAutomaticRule
036f3f272032 : Update BaseBundle to not use LazyValues when using ReadWriteHelper
2966a4499435 : Do not send AccessibilityEvent if notification is for different user.
4476230208eb : Do not send new Intent to non-exported activity when navigateUpTo
2d134d028df9 : Move accountname and typeName length check from Account.java to AccountManagerService.
f81499055cdc : switch TelecomManager List getters to ParceledListSlice
1ae90b98f0eb : Enforce zen rule limit on a package level.
d2a2c552b3ba : Strip transition information from activityoptions when sent to app
0531e9c02e5e : Block FullScreenIntent while device is in use if notification has a silencing GroupAlertBehavior.
2b63eb0d2fe7 : Fix Notification redaction when power cycling a non-dozing device while occluded.
7fe9436d3860 : Perform the user-allowlist check after all other fixed allowlist check
4fa175abc8b4 : Revert "Revert "Limit the number of concurrently snoozed notifications""
6bf29758c66a : Stop crashing the system on hitting the alarm limit
5e0dd5db86d0 : Remove package name from SafetyNet logs

8cec42b : Fix OOB crash for registerLocaleList
335db81 : Fix OOB read for registerLocaleList

e7355d6b62 : Add additional bounds checks to NNAPI FMQ deserialize utility functions
9bce12a99f : Fix array out of bound in audioTransportToHal.

3612cbf : OOBR in NxpMfcReader::SendIncDecRestoreCmdPart2
aa44a2f : OOBW in phNxpNciHal_write_unlocked()

105e1702 : Removes unnecessary permission from the EmergencyInfo app.
7f1f837c : Prevent exfiltration of system files via avatar picker.
f3595637 : Revert "Prevent exfiltration of system files via user image settings."

11572fb213d : RESTRICT AUTOMERGE Make bluetooth switch not discoverable via SliceDeepLinkTrampoline
5b6b4b87bbf : Remove Intent selector from 2-pane deep link Intent
147848a4bc7 : [DO NOT MERGE] Add FLAG_SECURE for ChooseLockPassword and Pattern
a3881712a03 : Make bluetooth not discoverable via large screen deep link flow

4d51a097b9 : Add bounds check in avdt_scb_act.cc
0c19bbdc11 : Report failure when not able to connect to AVRCP
2fdc7b6231 : Fix OPP comparison
bb8740e4f0 : Pass IRK rotation flag into native
0bb80e1c0a : Add flag to toggle IRK rotation
dc463a94a8 : Reschedule address rotation after connection to advertising set
ade8d7fc31 : Rotate advertising set addresses on IRK change
331b9dee9e : Fix URI check in BluetoothOppUtility.java
8fffa0c87d : Fix interger overflow when parsing avrc response
e5899fa26a : Add length check when copy AVDT and AVCT packet
8d867aae99 : Add missing increment in bnep_api.cc
41f6353fb7 : Added max buffer length check
15a5c6531d : Add length check when copy AVDTP packet
a955d3b653 : Add buffer in pin_reply in bluetooth.cc
0dc87823d7 : Add negative length check in process_service_search_rsp
30178c6f27 : Add local to pan_api.cc
c26dc0b16b : Ignore calls to set the address policy after it has already been set
ba297535a6 : Reconfigure Address policy on last bond removed
9f563b220c : Fix potential interger overflow when parsing vendor response

3fe79c1e65 : [RESTRICT AUTOMERGE] Restrict halfsheet cancel broadcast

75337db4c : Add additional bounds checks to NNAPI FMQ deserialize utility functions

4c52cd0f3 : Add one-time flag to permission if group is currently one-time

643cdee055 : wifi: Reset to default SAP configuration when doing factory reset
d7df9d633c : [Passpoint] Add more check to limit the config size
f600d9210c : [DO NOT MERGE] passpoint: validate decorated identity prefix
6fbaa0f62c : [DO NOT MERGE] wifi: remove certificates for network factory reset
44026b7c95 : Prevent restricted user from adding network through camera

e2edf1fce : Set intent priority for PICK_IMAGES
3cb8e5d3a : isDataOrObbPath blocks access to Android/[data|obb] dirs only
13b399d58 : DO NOT MERGE Avoid path traversal in MediaProvider delete call

046d4880 : Check dir path before updating permissions.

5b763ee4c : Fix security vulnerability issue for multi user call redirections.
8d77a5eb7 : Fix security vulnerability when register phone accounts.
3262c7419 : Hide overlay windows when showing phone account enable/disable screen.
99b85f98d : Fix security vulnerability issue for multi user call redirections.
404c0ca49 : switch TelecomManager List getters to ParceledListSlice

8fa091703 : prevent overlays on the phone settings

dc8a57a : Use sp<T>::make to create the sp pointer for EventLoopCallback

7068cbc4 : The length of a packet should be non-zero